Mit Sammlungen den Überblick behalten
Sie können Inhalte basierend auf Ihren Einstellungen speichern und kategorisieren.
Signatur einer genehmigten Anfrage validieren
Jede genehmigte Zugriffsanfrage wird mit einem asymmetrischen kryptografischen Schlüssel signiert, um die Genehmigung zu bestätigen. Genehmigte Anfragen können mit einem Google-owned and managed key oder einem vom Kunden bereitgestellten Cloud KMS-Schlüssel signiert werden.
Wenn Sie eine Signatur validieren, können Sie sicher sein, dass der Bytestring der serialisierten genehmigten Anfrage gültig ist. Um die Validierung der Inhalte der Genehmigung abzuschließen, müssen Sie die Nachricht deserialisieren und mit den Inhalten der genehmigten Anfrage vergleichen.
Hinweise
Damit das Access Approval-Dienstkonto für Ihre Ressource die erforderlichen Berechtigungen zum Überprüfen genehmigter Anforderungssignaturen hat, bitten Sie Ihren Administrator, dem Access Approval-Dienstkonto für Ihre Ressource die IAM-Rolle Cloud KMS CryptoKey-Signierer/Prüfer (roles/cloudkms.signerVerifier) für den Schlüssel, den Schlüsselbund oder das Schlüsselprojekt zuzuweisen.
Ihr Administrator kann dem Dienstkonto für die Zugriffsgenehmigung für Ihre Ressource möglicherweise auch die erforderlichen Berechtigungen über benutzerdefinierte Rollen oder andere vordefinierte Rollen erteilen.
Anfrage validieren, die mit einem Google-owned and managed keysigniert wurde
Rufen Sie in der Google Cloud Console die Seite Zugriffsgenehmigung auf.
Notieren Sie sich unter Vom Kunden verwalteter Schlüssel die Ressourcen-ID des Schlüssels.
Rufen Sie den öffentlichen Schlüssel für den Schlüssel ab, den Sie im vorherigen Schritt identifiziert haben. Speichern Sie den heruntergeladenen öffentlichen Schlüssel im PEM-Format als ./public_key.
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-09-04 (UTC)."],[[["\u003cp\u003eAccess Approval requests are signed with either a Google-managed key or a customer-provided Cloud KMS key to validate the approval.\u003c/p\u003e\n"],["\u003cp\u003eValidating a signature confirms the integrity of the bytestring of the serialized approved request, which must also be deserialized and compared with the approved request's contents.\u003c/p\u003e\n"],["\u003cp\u003eThe Access Approval service account must be granted the \u003ccode\u003eroles/cloudkms.signerVerifier\u003c/code\u003e IAM role on the key, key ring, or key project to ensure it has the necessary permissions to verify request signatures.\u003c/p\u003e\n"],["\u003cp\u003eValidation involves copying the public key, signature, and serialized approval request from the Google Cloud console to Cloud Shell, decoding them, and using \u003ccode\u003eopenssl\u003c/code\u003e to verify the signature.\u003c/p\u003e\n"],["\u003cp\u003eThe result \u003ccode\u003eVerified OK\u003c/code\u003e from \u003ccode\u003eopenssl\u003c/code\u003e confirms that the serialized request is valid, regardless of if it was signed with a Google or customer-managed key.\u003c/p\u003e\n"]]],[],null,["# Validate an approved request signature\n======================================\n\nEach approved Access Approval request is signed with an asymmetric\ncryptographic key to validate the approval. Approved requests can be signed with\na Google-owned and managed key or a customer-provided\nCloud KMS key.\n\nWhen you validate a signature, you can be sure that the bytestring of the\nserialized approved request is valid. To finish validating the contents of the\napproval, you must deserialize the message and compare the deserialized\nmessage with the contents of the approved request.\n\nBefore you begin\n----------------\n\n\nTo ensure that the Access Approval service account for your\nresource has the necessary\npermissions to verify approved request signatures,\n\nask your administrator to grant the Access Approval service account for your\nresource the\n\n\n[Cloud KMS CryptoKey Signer/Verifier](/iam/docs/roles-permissions/cloudkms#cloudkms.signerVerifier) (`roles/cloudkms.signerVerifier`)\nIAM role on the key, key ring, or key project.\n\n\n| **Important:** You must grant this role to the Access Approval service account for your resource, *not* to your user account. Failure to grant the role to the correct principal might result in permission errors.\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\n\nYour administrator might also be able to give the Access Approval service account for your\nresource\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nValidate a request signed using a Google-owned and managed key\n--------------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. Under **Google-managed public key** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the public key as a new file named\n `public_key`:\n\n echo \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e \u003e ./public_key\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e with the contents of\n the **Google-managed public key** field.\n5. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n6. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n7. Decode the signature using the `base64` command and save the result as\n `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n8. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n9. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n10. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid.\n\nValidate a request signed using a customer-provided key\n-------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n5. Decode the signature and save the result as `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n6. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n7. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n8. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n9. Under **Customer-managed key**, make note of the resource identifier of\n the key.\n\n10. [Retrieve the public key](/kms/docs/retrieve-public-key) for the key that\n you identified in the previous step. Save the downloaded public key in the\n PEM format as `./public_key`.\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid."]]
